A very easy way to stop users from installing software is to install
Deepfreeze. It basically locks the hard drive down so that if users do
install software or make changes to the system, they are reset the next time
the computer reboots. I have found this to MUCH more effective than any
Windows policy restriction. I even let users log in as local administrators
so that I don't have to deal with software incompatibilities with
permissions. If they hose their system up or get a virus, it is deleted the
next time they reboot their system.

-Jesse Weigert

-----Original Message-----
From: chang zhu [mailto:cyz2000 (at) yahoo (dot) com [email concealed]]
Sent: Friday, October 08, 2004 5:46 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Can we really block users from installing applications through
Group policy?

Hi, all

The users are not local administrators. We configure group policy to
prevent user installs but it seems that it blocks only .msi packages. Users
still can install applications through ex. setup.exe...Can we really block
users from installing applications through Group policy?

Any idea or thoughts on this?

Plus, if we need to block users from saving .mp3 file on their computers,
can we do it through group policy?

we are on windows2000 and XP environment.

Thanks always,

Chang

_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]